Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants that tag, RabbitMQ updates the OAuth backend implementation (token/scopes/expiry) but leaves the connection's runtime #user.tags unchanged. rabbitaccesscontrol:checkuserid/2 then still honors the stale impersonator tag, so the connection (including newly opened channels) can continue publishing messages with a foreign AMQP userid after that privilege should have been revoked. A fresh connection using the downgraded token correctly refuses the same publish, proving the defect is stale session state rather than the token Limited to connections that once held impersonator and successfully refresh to a downgraded same-username rabbitauthbackendoauth2 (or an equivalent refresh-capable backend that returns tags) is enabled for This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
This issue is already fixed upstream in RabbitMQ 4.3.6, which is the version currently built for Fedora rawhide (rabbitmq-server-4.3.6-1.fc46) and Fedora 45 (rabbitmq-server-4.3.6-1.fc45). Fedora 44 (currently 4.2.9) and Fedora 43 (currently 4.0.9) still need attention; backports/rebases for the still-supported stable branches are being worked on. Leaving this report open to track that remaining work.
FEDORA-2026-fff73c7d8a (rabbitmq-server-4.2.9-3.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-fff73c7d8a
FEDORA-2026-fff73c7d8a has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fff73c7d8a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fff73c7d8a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-bfe9cc4c24 (rabbitmq-server-4.2.9-4.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-bfe9cc4c24
FEDORA-2026-baae3b217a (rabbitmq-server-4.0.9-6.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-baae3b217a
FEDORA-2026-bfe9cc4c24 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-bfe9cc4c24` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bfe9cc4c24 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-baae3b217a has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-baae3b217a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-baae3b217a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ea1afc0a7b (rabbitmq-server-4.0.9-7.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ea1afc0a7b